fix: attach CSRF token to state-changing requests

frontend/src/lib/csrf.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, it, beforeEach, afterEach } from 'vitest'
+import { csrfHeader } from './csrf'
+
+let originalCookie = ''
+
+describe('csrf utilities', () => {
+  beforeEach(() => {
+    originalCookie = document.cookie
+    document.cookie = 'dodo_csrf=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/'
+  })
+
+  afterEach(() => {
+    document.cookie = originalCookie
+  })
+
+  it('adds the x-csrf-token header for write methods', () => {
+    document.cookie = 'dodo_csrf=token123; path=/'
+    expect(csrfHeader('POST')).toEqual({ 'x-csrf-token': 'token123' })
+    expect(csrfHeader('PATCH')).toEqual({ 'x-csrf-token': 'token123' })
+    expect(csrfHeader('DELETE')).toEqual({ 'x-csrf-token': 'token123' })
+  })
+
+  it('leaves read methods untouched', () => {
+    document.cookie = 'dodo_csrf=token123; path=/'
+    expect(csrfHeader('GET')).toEqual({})
+    expect(csrfHeader(undefined)).toEqual({})
+  })
+
+  it('does not add a header when the cookie is missing', () => {
+    expect(csrfHeader('POST')).toEqual({})
+  })
+})